fix: validate split short-option values

codex · Byron · Byron · commit e8d0fbf774d1 · 2026-07-22T05:54:45.000+02:00
Single-character keyword arguments are transformed into an option token and a separate value token. The unsafe-option candidate builder only checked the keyword name, allowing an option-like value to bypass guards shared by clone, remote, revision, blame, and archive operations. Include dash-prefixed values only when short options are actually split, including sequence values, while preserving bare values and the non-splitting compatibility path. Git baseline a23bace9 defines clone -n and --upload-pack as distinct options, matching the argv boundary this validation now preserves. Refs GHSA-r9mr-m37c-5fr3. Co-authored-by: Sebastian Thiel <sebastian.thiel@icloud.com>
diff --git a/git/cmd.py b/git/cmd.py
@@ -1039,11 +1039,18 @@ def _option_candidates(cls, args: Sequence[Any] = (), kwargs: Optional[Mapping[s
             option for option in cls._unpack_args([arg for arg in args if arg is not None]) if option.startswith("-")
         ]
         if kwargs:
+            split_single_char_options = kwargs.get("split_single_char_options", True)
             for key, value in kwargs.items():
                 values = value if isinstance(value, (list, tuple)) else (value,)
                 if any(value is True or (value is not False and value is not None) for value in values):
                     key = str(key)
                     options.append(f"-{key}" if len(key) == 1 else f"--{dashify(key)}")
+                    if len(key) == 1 and split_single_char_options:
+                        options.extend(
+                            str(value)
+                            for value in values
+                            if value is not True and value not in (False, None) and str(value).startswith("-")
+                        )
         return options
 
     AutoInterrupt: TypeAlias = _AutoInterrupt
diff --git a/test/test_git.py b/test/test_git.py
@@ -214,6 +214,23 @@ def test_option_candidates_ignore_untransformed_kwargs(self):
 
         self.assertEqual(options, ["--max-count"])
 
+    def test_option_candidates_include_split_single_char_option_values(self):
+        cases = [
+            ({"n": "--upload-pack=helper"}, ["-n", "--upload-pack=helper"], ["--upload-pack"]),
+            ({"g": ("safe", "--out=target")}, ["-g", "--out=target"], ["--output"]),
+        ]
+
+        for kwargs, candidates, unsafe_options in cases:
+            self.assertEqual(Git._option_candidates(kwargs=kwargs), candidates)
+            with self.assertRaises(UnsafeOptionError):
+                Git.check_unsafe_options(options=candidates, unsafe_options=unsafe_options)
+
+        self.assertEqual(self.git.transform_kwargs(n="--upload-pack=helper"), ["-n", "--upload-pack=helper"])
+
+        unsplit_kwargs = {"n": "--upload-pack=helper", "split_single_char_options": False}
+        self.assertEqual(self.git.transform_kwargs(**unsplit_kwargs), ["-n--upload-pack=helper"])
+        self.assertEqual(Git._option_candidates(kwargs=unsplit_kwargs), ["-n"])
+
     _shell_cases = (
         # value_in_call, value_from_class, expected_popen_arg
         (None, False, False),
